From: Tom Holub (tom@LS.Berkeley.EDU)
Date: Tue Jun 12 2001 - 13:31:07 PDT
On Tue, Jun 12, 2001 at 12:55:29PM -0700, Mikael Hansen wrote:
> At 12:10 PM -0700 6/12/01, Aron Roberts wrote:
>
> >Why is this of significance?
> >----------------------------
> >To my knowledge, this is the first widely-reported attack on
> >Macintosh computers based on an AppleScript script.
>
> If I have read the web buzzing correctly, the Simpsons virus is an
> AppleScript run-only application and is therefore as such to the user
> really no different from an application written in C.
It's different in that many applications on the MacOS are AppleScript
aware, which allows a virus writer to write a simple script that's the
equivalent of "go to the address book and send mail to all the addresses
there", instead of having to re-write the mail program's address book
parser in C (and figure out where on the disk it stores its address
book, etc.)
AppleScript is a virtually exact analog to VBS here. It allows very
simple scripts to control complicated applications, and thus it's a
great tool for virus writers. The only reasons it hasn't been
utilized are that fewer virus writers are familiar with it, and the
host population is smaller.
-- Tom Holub (tom_holub@LS.Berkeley.EDU, 510-642-9069) College of Letters & Science 249 Campbell Hall------------------------------------------------------------------------ The following was automatically added to this message by the list server:
For information about MAGNet, its meetings and events, and its mailing list, including information on subscribing and unsubscribing, see the MAGNet Web site at <http://mac.berkeley.edu/help/magnet/>.
This archive was generated by hypermail 2b29 : Tue Jun 12 2001 - 13:32:33 PDT